Misleading "invalid algorithm" error on malformed public key
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- authentication, backend, security
Research direction
Start at verify.js line 123 and reproduce the malformed-public-key case with the linked jsonwebtoken-invalid-alg-repro project using the reported Node.js versions. Trace how the crypto failure is handled, and consider the issue complete when the original crypto error is surfaced instead of the misleading "invalid algorithm" error.
Written by the indexing model from the issue text.
Description
Description
On 9.0.0, we get the following error when trying to verify a JWT using a malformed public key:
JsonWebTokenError: invalid algorithm
In 8.x, we would get an error that would look something like:
Error: error:1E08010C:DECODER routines::unsupported
{
library: 'DECODER routines',
reason: 'unsupported',
code: 'ERR_OSSL_UNSUPPORTED'
}
The latter points us to a crypto error and suggests an issue parsing the key.
The former misleads the developer from the root issue.
The library should at least throw the original crypto error. Here is the line of code responsible for eating the error: https://github.com/auth0/node-jsonwebtoken/blob/master/verify.js#L123
Reproduction
https://github.com/Drew-Kimberly/jsonwebtoken-invalid-alg-repro
(uses dummy jwt/key from https://jwt.io)
Environment
- Version of this library used: 9.0.0
- Other relevant versions (language, server software, OS, browser): NodeJS 16.19.0 and 18.12.1
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
antfu-collective/icones#398 ·
-
ECmail.com Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
wesbos/burner-email-providers#554 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
radiantearth/stac-browser#1023 ·
-
HMR stops working Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
components-web-app/docs#92 ·